Agent Mail Gateway
Provides integration with Dovecot IMAP/SMTP mail servers, allowing AI agents to read, send, and manage email through the gateway with sender/recipient allow lists, HTML-to-Markdown conversion, attachments, and calendar invitations.
Offers an MCP server integration and plugin for Hermes Agent, enabling agents to securely access and manage their own email mailbox with policy controls, HTML/Markdown conversion, attachments, and calendar events.
Enables AI agents to interact with IONOS IMAP/SMTP mailboxes via the gateway, supporting filtered email reading and sending, HTML/Markdown conversion, attachments, and calendar invites with allow-list security.
Allows AI agents to access and manage email mailboxes hosted on Plesk through IMAP/SMTP, with sender/recipient allow lists, spoofing protection, HTML-to-Markdown conversion, attachments, and calendar invitation handling.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Agent Mail Gatewayschedule a meeting with alice@example.com for next Tuesday at 10am"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Agent Mail Gateway
Give every AI agent its own email mailbox — without giving it the keys to that mailbox.
Agent Mail Gateway is a small self-hosted Docker service that sits between your agents and ordinary IMAP/SMTP mailboxes (Plesk, IONOS, Outlook, your own server — any provider). Each agent gets one API key bound to exactly one mailbox. Through the gateway it can read mail, send mail with attachments, and send, update or cancel calendar invitations. You decide who each agent may receive mail from and who it may write to; everything else is filtered out.
Mail bodies are delivered to the agent as Markdown (converted from HTML) and the agent writes Markdown that is sent as HTML — far fewer tokens than raw HTML email.
In short: a self-hosted email MCP server and REST API for AI agents — IMAP/SMTP mailbox access with sender/recipient allow lists, HTML-to-Markdown, attachments and calendar invites, packaged as one Docker container.
Typical use cases
An assistant agent that sends you daily reports, summaries or alerts by email.
Agents that receive tasks or documents by email and answer them in the same thread.
Agents that schedule, move and cancel meetings with you via calendar invitations.
Giving several agents separate mailboxes on your existing mail server (Plesk, IONOS, Outlook, Postfix/Dovecot, …) without exposing the mailbox passwords to them.
Locking an agent down so it can only talk to approved people — useful against prompt injection by email and against agents mailing the wrong people.
Works with any MCP client (for example Hermes Agent, Cursor, VS Code, n8n, LangChain/LangGraph MCP adapters) and with anything that can make HTTP requests.
Features
N mailboxes, one key each — a key can never reach another mailbox.
Allow lists per mailbox for receiving and sending (
name@domainor*@domain).Filtered mail is invisible — not listed, not readable, not even by guessing an id. Non-allowed mail is moved to Trash (default) or left untouched.
Spoofing protection — senders must pass SPF/DKIM/DMARC as reported by your mail server.
HTML ⇄ Markdown conversion in both directions.
Attachments in and out.
Calendar invites (iCalendar) that update or cancel cleanly in Outlook, Gmail and Apple Calendar.
REST API with OpenAPI docs at
/docs, and an MCP server at/mcpwith the same tools.Webhooks (HMAC-signed) when an allowed message arrives; new mail is detected instantly via IMAP IDLE.
Send rate limit per mailbox and an audit log of every send, rejection and deletion.
Works with any IMAP/SMTP server: TLS on 993/465 or STARTTLS on 143/587.
Related MCP server: imap-smtp-mcp
How it works
Agent ──REST/MCP + API key──▶ ┌──────────────────────────────────────┐
│ Auth key → exactly one mailbox │
Agent ◀──signed webhook────── │ Policy sender/recipient checks │
│ Converter HTML ⇄ Markdown │
│ Calendar build/update/cancel .ics │
│ Mailbox IMAP read + IDLE watcher │──IMAP──▶ mail server
│ Sender SMTP + copy to Sent │──SMTP──▶
│ Store SQLite (small state) │
└──────────────────────────────────────┘
config.yaml + .env (read-only)The gateway stores no mail content; mail stays on your mail server.
Quick start
Get the files:
mkdir agent-mail-gateway && cd agent-mail-gateway curl -LO https://raw.githubusercontent.com/dominikamann/agent-mail-gateway/main/docker-compose.yml curl -L -o config.yaml https://raw.githubusercontent.com/dominikamann/agent-mail-gateway/main/config.example.yaml curl -L -o .env https://raw.githubusercontent.com/dominikamann/agent-mail-gateway/main/.env.exampleEdit
config.yaml: one entry per agent with its mailbox server, login and allow lists.Fill
.envwith the secrets referenced inconfig.yaml:openssl rand -hex 32 # an API key for each agent openssl rand -hex 24 # a webhook secret (optional)Start it:
docker compose up -d curl http://localhost:8080/health curl -H "Authorization: Bearer $AGENT_API_KEY" http://localhost:8080/v1/mailbox
Every option is explained in docs/configuration.md.
Using it
REST — send a message:
curl -X POST http://localhost:8080/v1/messages \
-H "Authorization: Bearer $AGENT_API_KEY" -H "Content-Type: application/json" \
-d '{"to":["you@yourmailserver.eu"],"subject":"Daily report","body_markdown":"All **green** today."}'Read new mail:
curl -H "Authorization: Bearer $AGENT_API_KEY" "http://localhost:8080/v1/messages?unread=true"MCP — point any MCP client at http://<host>:8080/mcp with the header
Authorization: Bearer <api key>. Tools: get_mailbox_info, list_messages, read_message,
get_attachment, mark_message, delete_message, send_message, create_event,
update_event, cancel_event, list_events.
See docs/api.md for every endpoint, the webhook format and examples.
Hermes Agent — connect the MCP server in ~/.hermes/config.yaml and install the plugin
that teaches your agents to use their mailbox safely:
hermes plugins install dominikamann/agent-mail-gateway/integrations/hermes/agent-mail-gateway --enableStep by step: docs/hermes.md.
Documentation
Security
Run the gateway behind a TLS reverse proxy when it is reachable from other machines. Report vulnerabilities privately as described in SECURITY.md.
License
Available Tools
11 toolscancel_eventB
Cancel an event you created; attendees get a cancellation.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. It usefully discloses two traits: the ownership prerequisite and that attendees receive a cancellation notification. However, it omits whether cancellation is irreversible, how it affects the organizer's own calendar, and what the call returns, leaving significant gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler — the action, the precondition, and the consequence arrive in order. Its weakness is under-specification rather than verbosity, which is penalized in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A destructive mutation tool with no annotations, no output schema, and an undocumented parameter. The description should at minimum cover irreversibility and the required scope of the id, none of which is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single required parameter (id) is undocumented in the schema. The description never mentions the parameter at all, so the agent gets no hint about whose event id is expected, its format, or where to obtain it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (cancel) plus resource (event), with an ownership scope ("an event you created") that separates it from update_event and delete_message. It does not explicitly name the sibling alternatives, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"An event you created" implies a usage precondition — you cannot cancel others' events — but there is no explicit when-to-use/when-not guidance or routing to alternatives such as update_event for rescheduling versus cancelling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_eventC
Send a calendar invitation. Times without offset use the given or mailbox time zone.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | ||
| start | Yes | ||
| title | Yes | ||
| location | No | ||
| timezone | No | IANA zone for times without offset; defaults to the mailbox timezone | |
| attendees | Yes | ||
| description_markdown | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It usefully discloses one real behavioral rule (offset-less times resolve to the given or mailbox time zone), but omits whether invitations are emailed to attendees, permission requirements, or idempotency behavior for a write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the purpose front-loaded and the timezone caveat second; nothing is wasted. It is efficient but very sparse given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter write operation with no annotations and no output schema, the description is thin: it does not explain notification behavior, required attendees, failure modes, or the shape of the created event, leaving the agent under-equipped.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 14% (only timezone is documented), so the description must compensate and largely does not. It clarifies time/timezone handling but says nothing about attendees, title, location, or description_markdown semantics beyond what the schema names imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Send a calendar invitation" gives a clear verb (create/send) and resource (calendar event), and the name aligns with it. It is distinguishable from update_event and cancel_event by its creation framing, though the description never explicitly contrasts with those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus update_event, cancel_event, or send_message, nor any stated preconditions. The agent must infer everything from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_messageB
Move a message to Trash (only if the mailbox allows deleting).
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Message id from list_messages |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden, and it does add real value by revealing this is a move to Trash (recoverable soft delete) rather than a permanent purge, plus a mailbox-capability precondition. However, it omits auth/permission errors, failure behavior, and what happens if the mailbox disallows deletion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with the core action front-loaded and the key constraint in a parenthetical. Zero wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, no-output-schema tool the description covers the essential shape: what happens to the message, the soft-delete semantics, and the precondition. It is nearly complete, missing only error/permission failure behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a single 'id' parameter documented as 'Message id from list_messages', so the baseline is 3. The description adds nothing about the parameter, but nothing is needed given the schema already fully documents it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Move a message to Trash'), and the parenthetical clarifies it is a soft-delete rather than permanent removal, which distinguishes it from a hard-delete interpretation. No explicit naming of siblings like mark_message or read_message, so it is clear but not sibling-differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance or alternatives — it never says to use this instead of mark_message or how it relates to other message-mutating tools. The parenthetical 'only if the mailbox allows deleting' is a runtime precondition, not usage direction for the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentC
Download an attachment of a message.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Message id from list_messages | |
| index | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says nothing about permissions required, whether the operation is read-only, whether it marks the message as read, size or rate limits, or whether the returned payload is a file path, URL, or binary blob.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no fluff and the core action front-loaded. It is efficient but so terse that it borders on under-specification rather than true conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with no annotations and no output schema, the description should explain return behavior and the meaning of the index. It leaves an agent guessing at both, so it is not complete enough to invoke the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With two parameters and only 50% schema description coverage, the description must compensate but adds nothing. It never explains that 'id' refers to a message identifier or what the numeric 'index' selects, so the undocumented index parameter remains ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ('Download') with a specific resource ('an attachment of a message'), so an agent can tell it apart from read_message or get_mailbox_info. However, it doesn't clarify what the download yields (binary content, a URL, or metadata), which leaves the purpose slightly incomplete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no alternative named, and no exclusions. The phrase 'of a message' only weakly implies the workflow (fetch a message, then its attachment) and no sibling such as read_message is referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mailbox_infoB
Your mailbox address and who you may receive mail from and send mail to.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It implies a read by describing returned data but says nothing about permissions required, whether the mailbox identity can change, or how the allowlist is represented. For a zero-parameter identity tool the burden is light, but the gap is still real.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no padding, appropriately sized for a trivial zero-param tool. The phrasing 'who you may receive mail from and send mail to' is slightly awkward but still parses quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey what comes back, and it does at a high level: the mailbox address and the permitted sender/recipient set. It omits format details (e.g., whether allowlists are addresses, domains, or patterns), but for a no-argument info tool this is close to sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters (0 required, empty properties), so there is nothing to document and the baseline of 4 applies. The description correctly adds no parameter detail, as there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource content (mailbox address plus inbound/outbound allowlists), which distinguishes it from the list_*/send_* siblings. However, it is a noun phrase with no action verb, so it never explicitly states that the tool retrieves this information rather than configuring it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of alternatives among the ten sibling tools. The agent must infer that this is the identity/permissions lookup step before send_message or read_message.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_eventsC
Events created by this mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does not meet it. It never confirms this is a safe read, says nothing about ordering, result size, pagination, or whether cancelled past events are included — all material for a list operation an agent will chain into other event tools.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no waste, so it is not verbose. However, the brevity comes from under-specification rather than efficiency — a noun fragment is not a usable instruction on its own.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list tool with no output schema, the description needed to cover at least the return shape and scope semantics (e.g. time bounds, inclusion of cancelled events). It provides only a partial scope hint, leaving the agent to guess what comes back.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema is empty, so there is nothing for the description to explain; the baseline for a parameterless tool is 4. No parameter-meaning gaps exist to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The fragment names the resource (events) and adds a real scoping qualifier — 'created by this mailbox' — which distinguishes it from events the mailbox was merely invited to. But it contains no verb, so the listing action is only inferable from the tool name, and it does nothing to set itself apart from sibling event tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no reference to alternatives such as list_messages or get_mailbox_info. The mailbox-scoping phrase implies a filter but never states the condition under which an agent should choose this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_messagesB
List received messages (newest first). Only mail from allowed senders is visible.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | Only messages received at or after this date (YYYY-MM-DD) or date-time | |
| cursor | No | next_cursor from a previous call | |
| unread | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose two useful traits: default ordering (newest first) and a visibility restriction (only mail from allowed senders). It omits pagination behavior, auth/scope requirements, and what happens when the sender filter excludes everything.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and followed by the key constraint. No padding or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the essentials for a list tool (what, order, visibility), but with no annotations, no output schema, and two undocumented parameters, the agent lacks guidance on pagination via cursor and the unread filter. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%: 'limit' and 'unread' carry no schema description, and the description adds nothing about any parameter. The ordering note does not map to a declared sort parameter, so the ambiguity around limit and unread is left unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("List received messages") and adds ordering ("newest first"), which distinguishes it from read_message and list_events. However, it does not name or contrast with siblings explicitly, so differentiation is inferable rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named (e.g., read_message for a single message). The only conditional content is the visibility constraint, which is a behavioral fact rather than usage routing. An agent must infer usage entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_messageC
Mark a message as read or unread.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Message id from list_messages | |
| unread | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full burden. It conveys that this mutates read state but says nothing about idempotency, whether the change is reversible, or that a toggle-style boolean controls direction. For a mutation tool with zero annotation coverage this is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the action front-loaded and no filler. It is efficient, though brevity here shades into under-specification rather than tightness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the description covers the core action. However, with no annotations and an undocumented `unread` parameter, it leaves an agent guessing at permission needs and the boolean's polarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: `id` is documented in the schema, `unread` is not. The description implies the boolean selects between marking read and unread, partially compensating, but it never states which value maps to which state, leaving the key semantic gap unfilled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (mark) and resource (message) plus the two resulting states (read/unread), so the action is unambiguous. It does not explicitly contrast itself with siblings like read_message or list_messages, but the verb distinguishes it adequately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus alternatives such as read_message (which likely also affects read state) or list_messages. No prerequisites, no mention that an id from list_messages is required (that hint lives only in the schema).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_messageA
Read one message with its body as Markdown. Marks it as read unless mark_read is false.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Message id from list_messages | |
| mark_read | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it discloses the critical surprise: a 'read' operation mutates state by marking the message read unless mark_read is false. It omits any mention of permissions, failure behavior for a bad id, or whether attachments are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, the return format front-loaded ahead of the side-effect caveat. Every clause carries information and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with no output schema, the description covers purpose, returned representation, and the state-changing default, which is what an agent needs to call it safely. The main remaining gap is routing guidance against the other read/attachment siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50% because mark_read has no schema description, and the description compensates by defining exactly what it does ('unless mark_read is false'). The id parameter's meaning is already carried by the schema text 'Message id from list_messages'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Read one message') plus the return format ('body as Markdown'), which distinguishes it from the plural list_messages sibling. It stops short of naming the sibling it replaces, so an agent must infer the boundary between listing and reading.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this versus get_attachment, mark_message, or list_messages, and no prerequisites are given. Usage is only implied by the verb, leaving the agent to guess at routing among eleven siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send an email written in Markdown. Every recipient must be on the allow list. Attachments are base64.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipients; every address must be on allow_send_to | |
| bcc | No | ||
| subject | Yes | ||
| attachments | No | ||
| reply_to_id | No | id of a received message this replies to | |
| body_markdown | Yes | Message body in Markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the allow-list gate and the base64 attachment encoding, but says nothing about irreversibility of sending, error behavior for non-allowed addresses, rate limits, or whether a message can be recalled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, declarative sentences with zero filler; the core action and the two most failure-prone constraints (allow list, base64) are front-loaded in that order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no annotations and no output schema, the description covers only the allow-list rule and encoding format. Missing are send irreversibility, failure semantics, and any per-parameter nuance for cc/bcc/subject/reply_to_id.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 43%. The description reinforces allow-list scoping (which the schema documents only for 'to', so extending it to cc/bcc adds value) and repeats the Markdown/base64 details already in the schema. It adds nothing about subject length limits, reply_to_id behavior, or attachment size.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource ('Send an email') plus two salient characteristics (Markdown body, base64 attachments). This clearly separates it from the read/mutation siblings like list_messages, read_message, and delete_message, though it never explicitly names an alternative or contrast set.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives one hard precondition ('Every recipient must be on the allow list') which tells the agent when a call will succeed, but offers no when-to-use framing, no alternative tool naming, and no guidance on cc/bcc vs to. Usage is implied rather than taught.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_eventA
Change an event you created; attendees get an updated invitation.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| end | No | ||
| start | No | ||
| title | No | ||
| location | No | ||
| timezone | No | IANA zone for times without offset; defaults to the mailbox timezone | |
| attendees | No | ||
| description_markdown | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose one important behavioral trait: attendees receive an updated invitation, which is exactly the side-effect an agent needs to know before mutating a shared event. However, it omits whether updates are partial or full-replace, whether clearing fields is possible, permission requirements, and whether notifications can be suppressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence, front-loaded with the verb and resource, with the side effect as a subordinate clause. Nothing wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations, no output schema, and 8 parameters with only 13% schema coverage. The description should compensate for this sparse structured data but does not — it says nothing about partial updates, required ownership/auth, notification behavior, or timezone semantics beyond the schema's own field description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 13% (only the timezone field has a description). Eight parameters, including start/end with strict patterns and attendees with an email format, are undocumented in the description. The description adds zero parameter guidance beyond the general message, leaving half the surface area unexplained in both schema and prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource ('Change an event') with an explicit ownership scope ('you created') that differentiates it from siblings like create_event and cancel_event. The second clause ('attendees get an updated invitation') specifies the side effect, which no sibling shares.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The ownership constraint ('you created') implies when this tool applies versus cancel_event or create_event, but no alternatives are named and no prerequisites are stated. Adequate for a mid-range social-calendar tool, but guidance is inferential rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
cancel_event - First observed
create_event - First observed
delete_message - First observed
get_attachment - First observed
get_mailbox_info - First observed
list_events - First observed
list_messages - First observed
mark_message - First observed
read_message - First observed
send_message - First observed
update_event
TDQS
Scored across 11 tools
Tools mostly target distinct resources and actions: messages versus events, and read/list/send/delete are separable. read_message and mark_message overlap slightly around marking messages as read, but the descriptions make selection clear.
All tools use snake_case with a consistent verb_noun pattern, such as list_messages, read_message, send_message, create_event, and cancel_event. The naming is predictable throughout.
At 11 tools, the set is well-scoped for an email and calendar gateway. Each tool covers a specific operation without obvious redundancy.
The surface covers core email workflows (list/read/send/delete/mark/attachments) and calendar event create/update/cancel/list operations. Minor gaps remain, such as no reply/forward/search for messages and no single-event detail or RSVP handling, but agents can work around them.
Maintenance
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Your agent needs a mailbox of its own — to receive, thread, draft and send, with attachments, without borrowing your personal inbox or your company's SMTP. **What you can ask for** • "Create an inbox for this agent and tell me its address." • "Read the new messages in this thread and draft a reply." • "Send this message with the attachment and wait for the response." • "Search this inbox for everything from that domain." • "Show delivery metrics and the events on this inbox." **How to use it** Point any MCP client at https://mcp.aisa.one/mail/mcp and sign in with OAuth — there is no key to create or paste. 49 tools: create and delete inboxes, list and read messages, raw message bodies, attachments, threads, drafts and draft attachments, send and reply, message search, inbox events, metrics, and list entries — reads and writes. **Why this rather than the source** A real inbox an agent owns, rather than an SMTP credential it borrows from a human. **It is also a door to the rest** The same login reaches 26 sources and 580+ operations. Find the contact elsewhere in the catalogue, then write to them from here — without adding a second server. **What it costs** Finding and inspecting an operation is free. Running one is billed per call at API prices, with no seat and no monthly minimum, and every call takes max_price_usd so an agent cannot overspend by accident. **Where else it reaches** https://mcp.aisa.one/sales/mcp finds the person to write to.
Hosted email for AI agents: create inboxes, send, receive, and reply over MCP with scoped API keys
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA generic IMAP and SMTP MCP server that enables AI agents to interact with email accounts for reading, searching, and sending messages. It provides high-level tools for managing email workflows like daily digests and folder organization across any standard email provider.1MIT
- AlicenseNot gradedqualityAmaintenanceExposes any IMAP mailbox and SMTP relay as MCP tools, enabling email management (read, search, send, delete) through MCP-compatible agents.1MIT
- AlicenseNot gradedqualityBmaintenanceConnects any IMAP/SMTP mailbox to AI agents via MCP, enabling email read, search, send, reply, and management through natural language.6 npmMIT
- AlicenseNot gradedqualityAmaintenanceA self-hosted MCP server that unifies multiple IMAP/SMTP mailboxes into one agentic inbox, enabling agents to list, search, read, and send email through MCP tools.MIT